These two commands you mention in your question:
iptables -A INPUT -s 10.147.18.80 -j ACCEPT
iptables -A OUTPUT -d 10.147.18.80 -j ACCEPT
They append those rules to the end of the chains.
-A
option appends the rule to the end.
If you use -I
option you will put the rule to the top of the chain.
The issue here is that you probably have already have a DROP
or REJECT
rule, before the ACCEPT
the rule in one of the chains that drops the traffic before it reaches the end of the chain.
Like for instance a rule that drops traffic to or from a whole subnet that contains the IP 10.147.18.80.
If you have a rule in a chain that drops/rejects traffic to that IP, or from that IP depending if it is a INPUT or OUTPUT chain, before the ACCEPT rule, then whether the rule specifies just that IP or the whole subnet, traffic gets dropped and all other rules in the chain are not processed any more.
DROP
, REJECT
, ACCEPT
are terminating targets, once iptables matches that rule, it stops processing other rules in the chain, it doesn't proceed to the next rule.
Try
iptables -I INPUT -s 10.147.18.80 -j ACCEPT
iptables -I OUTPUT -d 10.147.18.80 -j ACCEPT
This will put those rule on top of the chains so they are the first rules to be hit, and other rules won't be processed then for that traffic in those chains.
You can list all rules in a chain with something like
iptables -nvL
or if you want o view just specific chains
iptables -nvL INPUT
iptables -nvL OUTPUT
EDIT
Given the output you pasted, and the fact you can ping if you change default actions to ACCEPT
this doesn't seem to be the issue.
You can use something like tcpdump to see if the traffic is going any and being returned.
Command like this will give you all icmp packets being sent or received by the machine
tcpdump -nnvvi any icmp
If you get something like this in the output
10:13:48.866598 IP (tos 0x0, ttl 255, id 30625, offset 0, flags [DF], proto ICMP (1), length 84)
10.147.18.192 > 10.147.18.80: ICMP echo request, id 26621, seq 4, length 64
10:13:48.867771 IP (tos 0x0, ttl 53, id 0, offset 0, flags [none], proto ICMP (1), length 84)
10.147.18.80 > 10.147.18.192: ICMP echo reply, id 26621, seq 4, length 64
Then your ping packets are being sent out, and returned, but being rejected by some other rule.
You can check if you maybe have some other rules in other tables like nat or mingle table, if maybe some of the rules there are conflicting with the traffic.
iptables -t nat -nvL
iptables -t mingle -nvL
You can also see if the packets are going through ACCEPT rule in OUTPUT chain by number under pkts
in the listing.
If that number is increasing after you try to ping, but the number in INPUT chain stay 0 then the issue is with incoming traffic rules.
Also check your routes, with ip r
command or something similar, if maybe the traffic is not exiting through the interface in same subnet so the source IP of returning packets maybe gets changed due to some NAT rules along the way.